topic Re: No results found, HUNK with MongoDB App installed in All Apps and Add-ons

No results found, HUNK with MongoDB App installed

khhenderson — Mon, 17 Nov 2014 16:27:30 GMT

I have checked my connection from my Hunk server using telnet to the mongo server on port 27017, works fine.
The indexes.conf seems to be setup correctly.

[provider:local-mongodb]
vix.mongodb.host = xxx.xxx.xxx.xxx:27017
vix.command = java
vix.splunk.search.debug = 1


[mongodb_vix]
vix.mongodb.collection = event
vix.mongodb.db = activity
vix.mongodb.auth.mechanism = 
vix.mongodb.auth.password = 
vix.mongodb.auth.username = 
vix.mongodb.field.time = _id
vix.mongodb.field.time.format = objectid

Then I run the following search I get "no results found"

index="mongodb_vix"

Did I miss anything?

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Mon, 17 Nov 2014 20:12:47 GMT

If you have password enabled MongoDB try:
vix.mongodb.auth.mechanism = CR
vix.mongodb.auth.username = [username]
vix.mongodb.auth.password = [password as plain text]

If your MongoDB does not use any authentication try and remove these vix.mongodb.auth.* flags from your Hunk configuration.

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Mon, 17 Nov 2014 20:12:48 GMT

Do you see any errors in the Splunk search.log file?
' Hunk UI -> Jobs -> Inspect Job -> all the way at the bottom you will see the link to the log file.

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Mon, 17 Nov 2014 20:12:48 GMT

Try changing the value for Java from vix.command = java
to vix.command = /bin/java
After that search through the search.log to see if you past this java error.

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Mon, 17 Nov 2014 20:12:48 GMT

Yes, that is a java version issue.
Try upgrading the version of your Java from 1.6 to 1.7. Once that is done, point vix.command = java to the new location.

Re: No results found, HUNK with MongoDB App installed

khhenderson — Mon, 17 Nov 2014 20:12:49 GMT

WOW, Thanks rdagan, making progress.
ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : Invalid authentication mechanism for MongoDB
Unsure is it's the mechanism or the user authentication.

Re: No results found, HUNK with MongoDB App installed

khhenderson — Mon, 28 Sep 2020 18:11:18 GMT

Ok, I have new "ERRORS"
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/erp/mongodb/MongoDBERP : Unsupported major.minor version 51.0
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClass1(Native Method)
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClassCond(ClassLoader.java:637)
11-17-2014 11:53:17.469 ERROR ERP.local-mongodb - Could not find the main class: com.splunk.erp.mongodb.MongoDBERP. Program will exit.
11-17-2014 11:53:17.472 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 11:53:17.472 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

Not sure if it's the Java version or something with the main index?

Re: No results found, HUNK with MongoDB App installed

khhenderson — Mon, 17 Nov 2014 20:12:49 GMT

@rdagan_splunk, Here are the only lines report "ERROR".

11-17-2014 08:37:12.615 ERROR ScriptRunner - Couldn't start child process. script="java -Xmx512m -classpath /opt/hunk/bin/jars/SplunkMR-s6.0-h1.0.jar:/opt/hunk/etc/apps/MongoDBApp/bin/hunk_mongodb_app.jar:/opt/hunk/etc/apps/MongoDBApp/bin/lib/* com.splunk.erp.mongodb.MongoDBERP"
11-17-2014 08:37:12.615 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 08:37:12.615 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

Re: No results found, HUNK with MongoDB App installed

khhenderson — Mon, 17 Nov 2014 20:16:38 GMT

Thanks rdagan, I've got the auth and password figured out. Here are my new errors.

11-17-2014 14:08:22.819 ERROR ERP.local-mongodb -  MongoDBERP - Exception while executing search process , Message : null
11-17-2014 14:08:22.823 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 14:08:22.823 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Mon, 17 Nov 2014 21:01:02 GMT

I suspect that Cannot consume data with unset stream_type means that you either have a wrong value for the DB (activity) or wrong value for the Collection (event).
Can you validate that you can
Open a MongoDB shell -> type ' use activity ' -> type ' db.event.find() '

Re: No results found, HUNK with MongoDB App installed

khhenderson — Mon, 28 Sep 2020 18:11:38 GMT

That seems to work from a shell on the Mongo server.
Do I need to set a "stream_type". Currently the vix.mode is set to stream. Is there a different setting I could try.
Here are the current errors:
11-18-2014 10:19:35.418 ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : null
11-18-2014 10:19:35.443 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-18-2014 10:19:35.444 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

Re: No results found, HUNK with MongoDB App installed

rdagan_splunk — Tue, 18 Nov 2014 16:55:44 GMT

if you want we can do a webex session and see if we can find the core of the problem (my email rdagan@splunk.com )